the GDPR will be enforced by the same entity that was enforcing this before, so why would it be different?

The truth is that obviously the authorities don't have an incentive to come after a minor player.